Filestore.Fortinet

Zimbra Collaboration Suite Local File Inclusion Vulnerability Exploited

First seen 31 Jan 2026, 03:24 UTC • •25.3

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A Local File Inclusion (LFI) vulnerability (CVE-2025-68645) has been identified in the Zimbra Collaboration Suite Webmail Classic UI, allowing unauthenticated attackers to exploit user-supplied request parameters. Successful exploitation may lead to the leakage of sensitive files and further compromise of the targeted environment. Active exploitation has been observed, and a public proof-of-concept exploit is available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 184d ago How this analysis works

More articles in this cluster (2)

Threat Graph

5 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Vulnerability (2)

CVE-2025-68645
Local File Inclusion

Affected Platform (2)

Zimbra Collaboration Suite
Zimbra Webmail

Relationships

CVE-2025-68645 targets Zimbra Collaboration Suite
CVE-2025-68645 targets Zimbra Webmail
Local File Inclusion targets Zimbra Collaboration Suite
Local File Inclusion targets Zimbra Webmail
Data Breach targets Zimbra Collaboration Suite
Data Breach targets Zimbra Webmail

Following this threat?

Track CVE-2025-68645 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway Sangoma Switchvox SMB Edition 8.3 is facing active exploitation of multiple vulnerabilities, particularly CVE-2026-9586, which allows unauthenticated SQL injection leading to remote code execution. The flaw can be exploited by sending crafted HTTP POST requests to the /pa endpoint, enabling attackers to execute…

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…